https://github.com/utoni/potd
A high scalable low to medium interactive SSH/TCP honeypot using Linux Namespaces, capabilities, seccomp, cgroups designed for OpenWrt and IoT devices.
https://github.com/utoni/potd
c capabilities cgroups honeypot openwrt sandbox seccomp ssh-honeypot
Last synced: 10 months ago
JSON representation
A high scalable low to medium interactive SSH/TCP honeypot using Linux Namespaces, capabilities, seccomp, cgroups designed for OpenWrt and IoT devices.
- Host: GitHub
- URL: https://github.com/utoni/potd
- Owner: utoni
- License: bsd-3-clause
- Archived: true
- Created: 2018-07-11T15:29:37.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2020-07-12T19:41:09.000Z (over 5 years ago)
- Last Synced: 2024-04-15T14:28:04.637Z (almost 2 years ago)
- Topics: c, capabilities, cgroups, honeypot, openwrt, sandbox, seccomp, ssh-honeypot
- Language: C
- Homepage:
- Size: 280 KB
- Stars: 28
- Watchers: 8
- Forks: 6
- Open Issues: 0
-
Metadata Files:
- Readme: README
- Changelog: ChangeLog
- License: COPYING
- Authors: AUTHORS
Awesome Lists containing this project
- awesome-honeypot - **20**星
README
honey[potd]aemon
================
This project is part of a BA thesis. It is currently in a pre-alpha state.
Dependencies
============
Kernel/libc requirements: Cgroups, Namespaces (UTS, IPC, PID, NET, CGROUPS)
Required: libssh, pthread
Optional: libseccomp
A chroot'able directory that contains an executable named '/bin/sh'.
HowTo
=====
Build:
- ./autogen.sh
- ./configure
- make
Run:
- Example:
./src/potd --redirect 0.0.0.0:2222:127.0.0.1:22222 \
--protocol 127.0.0.1:22222:127.0.0.1:33333 \
--jail 127.0.0.1:33333
This will process, filter and redirect all traffic incoming from 0.0.0.0:2222 to the
protocol handler at 127.0.0.1:22222 and if the protocol accepts it, it will forward
all traffic to the jail/sandbox at 127.0.0.1:33333.
(clunky atm, will be simplified in the future)
- Do not forget to set the --rootfs which contains an executable /bin/sh.
- see ./src/potd --help
Features
========
The server supports currently only shell channels but exec and direct-tcp channels are coming soon!
Supported protocols (at the moment):
- ssh with libssh
Protocols to implement:
- HTTP
- ssh with openssh
- SCADA
- MySQL
Suits perfect for your favoured Desktop/Server/OpenWrt Linux system.
TODOs
=====
- RESTful listener for output sampled data from different processes
(send (real-time)statistics about protocols/jails/etc to higher level apps)
- ptrace support for jailed processes (trace syscalls)
- improved event handling (maybe libevent?)
Software Architecture
=====================
see data/potd-arch.{svg,dia}